Using a Script to Configure ProsperOps Access for a Azure Savings Analysis
The user that is running the ProsperOps script in your Azure portal must have the following roles:
- Owner on the root management group
- Owner on the subscription where the billing data will be stored
- Billing Account Owner on your MCA billing profile or Enterprise Administrator on your EA billing account
Once you have set up an account on ProsperOps and provided the required Azure information, ProsperOps will provide you with the script. See enabling Azure permissions for Savings Analysis page.
The script will run through a series of steps to configure the service principal including:
- Upload ProsperOps certificate to the service principal
- Grant billing profile reader of the billing scope to the service principal
- Grant billing reader of the tenant root group to the service principal
- Grant owner of the storage account to the service principal
- Register the resource providers (Microsoft.BillingBenefits and Microsoft.CostManagementExports) on the subscription with the storage account
Note: The resource group name and storage account name can be changed to follow your naming policies. The resource group and storage account do not need to exist in your environment at this step. They will be created by the script or manual steps in the configuration process.
Multi Tenant Note: If your billing scope has multiple tenants, you will need to create the ProsperOps service principal in the tenant that has the most spend. The service principle will need to be configured on each additional tenant to allow the service principal to view the hourly volatility and estimate coverage for the subscriptions in the tenant. After the initial configuration is complete, the ProsperOps console will provide instructions to configure the additional tenants.